[pve-devel] [PATCH manager v2] Status/InfluxDB: add 'verify-certificate' option to disable ssl verification

[Dominik Csapak]

Signed-off-by: Dominik Csapak <d.csapak at proxmox.com>
---
changes from v1:
* rename to 'verify-certificate'
* factor out the options setting

i left the 'verify_hostname' => 0 in there, because it would not work
with it enabled for self-signed certificates, even with the correct
SAN/CN

 PVE/Status/InfluxDB.pm | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/PVE/Status/InfluxDB.pm b/PVE/Status/InfluxDB.pm
index fcb28800..ba434569 100644
--- a/PVE/Status/InfluxDB.pm
+++ b/PVE/Status/InfluxDB.pm
@@ -55,7 +55,13 @@ sub properties {
 	    type => 'integer',
 	    minimum => 1,
 	    default => 25_000_000,
-	}
+	},
+	'verify-certificate' => {
+	    description => "Set to 0 to disable certificate verification for https endpoints.",
+	    type => 'boolean',
+	    optional => 1,
+	    default => 1,
+	},
     };
 }
 sub options {
@@ -71,9 +77,24 @@ sub options {
 	timeout => { optional => 1},
 	'max-body-size' => { optional => 1 },
 	'api-path-prefix' => { optional => 1 },
+	'verify-certificate' => { optional => 1 },
    };
 }
 
+my $set_ssl_opts = sub {
+    my ($cfg, $ua) = @_;
+
+    my $cert_verify = $cfg->{'verify-certificate'} // 1;
+    if (!$cert_verify) {
+	$ua->ssl_opts(
+	    verify_hostname => 0,
+	    SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE,
+	);
+    }
+
+    return;
+};
+
 # Plugin implementation
 sub update_node_status {
     my ($class, $txn, $node, $data, $ctime) = @_;
@@ -145,6 +166,7 @@ sub send {
 	return $class->SUPER::send($connection, $data, $cfg);
     } elsif ($proto =~ m/^https?$/) {
 	my $ua = LWP::UserAgent->new();
+	$set_ssl_opts->($cfg, $ua);
 	$ua->timeout($cfg->{timeout} // 1);
 	$connection->content($data);
 	my $response = $ua->request($connection);
@@ -228,6 +250,7 @@ sub test_connection {
     } elsif ($proto =~ m/^https?$/) {
 	my $url = _get_v2url($cfg, "health");
 	my $ua = LWP::UserAgent->new();
+	$set_ssl_opts->($cfg, $ua);
 	$ua->timeout($cfg->{timeout} // 1);
 	# in the initial add connection test, the token may still be in $cfg
 	my $token = $cfg->{token} // get_credentials($id, 1);
-- 
2.30.2